Replace reCAPTCHA with Cloudflare Turnstile

To replace reCAPTCHA with Cloudflare Turnstile, you add a Turnstile widget with two keys, connect it through one maintained WordPress plugin, and remove reCAPTCHA so the form loads only one challenge. You do not need to proxy the whole site through Cloudflare for the widget to work.

Create the widget and copy both keys

Log in to the Cloudflare dashboard and open Turnstile. Add a widget for the hostname that serves your form. You receive a site key for the front end and a secret key for server-side checks. Keep the secret key out of public theme files and paste it only where the plugin asks for it.

Use one plugin, then retire reCAPTCHA

Choose a maintained WordPress plugin that supports Cloudflare Turnstile. Contact Form 7 has add-ons, some form builders include a field type, and dedicated Turnstile plugins work as well. Enter both keys in that plugin’s settings.

1. Place the Turnstile field on the same forms that used reCAPTCHA, such as contact, comments, login, or checkout.
2. Deactivate the reCAPTCHA plugin so two widgets do not render on one page.
3. Submit the form once in a private browser window and confirm the message or order actually saves.
4. Only after a clean test should you delete the old reCAPTCHA plugin.

What Turnstile does and does not do

Turnstile scores a request and returns a token that your server must verify. It is not a WAF, not Imunify, and not a way to hide wp-login.php. If the plugin never checks the token on the server, the widget is only decoration. Read the plugin notes for server-side verification, and pick another plugin if that step is missing.

You can run Turnstile with or without the orange cloud when you use Cloudflare in front of LogicWeb. The widget and full-site proxy are separate products that share a Cloudflare login.

When the form goes quiet after the switch

Common causes are a wrong secret key, a hostname missing from the widget list, or cache still serving the old script. Purge the LiteSpeed cache for that page and check the browser console for a Turnstile error rather than a generic script message. If you stacked two captchas by accident, remove both, confirm the form posts cleanly, then add Turnstile alone.

Cloudflare Turnstile needs two keys, one widget, and a clean remove of reCAPTCHA. Test each form end to end before you call the job done.